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About ISBA 


l 


ISBA is the only body representing the UK’s leading advertisers. Speaking with one 
voice on behalf of over 3,000 brands, we advocate a trusted advertising environment — 
transparent, accountable and effectively regulated. Working with our network of senior 
marketers, we help our members make better decisions both now and for the future. 


ISBA is one of the tripartite stakeholders that make up The Advertising Association, 
which represents advertisers, agencies and media owners. We play a unique advocacy 
role, ensuring our members’ interests are clearly understood and are reflected in the 
decision-making of media owners and platforms, media agencies, regulators and 
Government. 


Our priorities fall into the following areas; 


Accountability & Responsibility 
Through both public and private advocacy we will: 
e Drive faster progress within a defined timeframe for accountable, cross-platform, 
cross-channel audience measurement of commercial video. 
e Hold technology companies to account for improved standards of brand safety 
and ad fraud. 
e Shape future self-regulation of advertising to be fit for purpose. 
e Play a leading role in delivering industry accountability for digital content. 


Agency Alignment 
To ensure transparency and competitiveness we will: 
e Drive wider industry adoption of ISBA’s contract frameworks. 
e Ensure contract advice remains current and addresses marketers’ needs. 
e Define and drive take-up of best practices in media agency / client relationships. 


Data Compliance and Equivalency 
Through our advocacy and capability building we will: 
e Ensure that implications of data protection authorities’ GDPR enforcement 
actions are understood by advertisers. 
e Continue to exert influence on the finalised drafting of European ePrivacy 
regulation. 
e Ensure that government and advertisers are fully cognisant and prepared for the 
impact of Brexit on the sector. 


ISBA represents advertisers on the Committee of Advertising Practice (CAP) and the 
Broadcast Committee of Advertising Practice (BCAP) - sister organisations of the 
Advertising Standards Authority - which are responsible for writing the Advertising 
Codes. We are also members of the World Federation of Advertisers (WFA) and use our 
leadership role in such bodies to set and promote high industry standards as well as a 
robust, independent co-regulatory regime. 


TEER 


Framing our response 


5; 


ISBA share the goal of promoting practices that will help enable children to engage with 
online content in a safe environment. We support the UN Convention on the Rights of 
the Child, and in particular appreciate the focus on the role of parents and caregivers in 
protecting and promoting the best interests of the child. ISBA is committed to creating a 
safe and secure environment for children to operate online and wish to work with the ICO 
in amending the Code so that it achieves its objectives while maintaining and 
encouraging the benefits that online services give to children. 


However, having considered the proposals set out in the draft Code carefully we do not 
believe that they achieve the stated ambition to protect children. Instead we believe they 
will create confusion and the potential for a new set of risks and vulnerabilities. 


Given the significant nature of our concerns, those of our members and other trade 
bodies about the draft code, we believe more time should be allowed to consult and 
reconfigure the code so that it can meet its objectives without creating such adverse and 
damaging outcomes. 


Commentary 


8. 


10. 


11. 


12. 


The ICO sets an ambitious scope for the proposed Code. This ambitious scope sets 
requirements that are significantly more demanding than those under GDPR and go 
beyond privacy issues and cross over into content decisions. This will require 
fundamental changes to the way products and services are provided for different age 
groups 


As an example, the Code goes beyond the concept of requiring verifiable parental 
consent by including any online experience from which children are not specifically 
blocked. 


The draft Code sets out that it applies if the online product or service is “likely to be 
accessed by children in the UK”. This will lead to a broad interpretation in the draft Code. 
As set out in a joint letter with other industry bodies, we do not believe this was 
Parliament’s intention when drafting the relevant legislation (s123 of the Data Protection 
Act 2018) and would encourage the ICO to look at existing interpretations. Using a well- 
established definition is also helpful to ensure consistency and better understanding and 
compliance from industry. 


Furthermore, setting a “likely” standard would result in the Code having a broader 
extraterritorial reach than the GDPR and could create incentives to geo-block UK users 
to avoid the application of the age verification and other requirements of the Code. 


Finally, certain aspects of the proposed Code go far beyond data protection 
requirements. Standard 15 on Data Protection Impact Assessments (DPIA), requires 
companies to consider “broader risks to the rights and freedoms of children, including the 
potential for any significant material, physical, psychological or social harm”, as well 

as issues like self-esteem, peer pressure, encouraging excessive risk-taking or 
unhealthy behavior, excessive screen time, and interrupted/inadequate sleep patterns. 
These considerations fundamentally change the nature of DPIAs and broaden their 
application well beyond the data protection purposes of the GDPR. 
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Age Verification 


13. The compliance options set out in the Code are either to apply standards to all users by 
default or to offer a robust and effective age-verification mechanism. The 
recommendation is for the latter in order to tailor the experience for each age range. 


14. Whilst the ICO make clear that age verification does not solve every issue, the draft 
Code will inevitably encourage much greater use of it. This is likely to deliver two 
consequences; requiring significantly more data collection of both adults and children in 
direct contradiction to the principle of data minimization; or potentially lead to arbitrary 
age-gating that would restrict children’s ability to benefit from the online world. The latter 
would seriously limit their rights outlined in Article 13 of the UN Convention on the Rights 
of the Child “to seek, receive and impart information and ideas of all kinds, regardless of 
frontiers”. 


15. The draft Code states that providers of information society services (ISS) should make 
sure that age-verification mechanisms are robust and effective and demonstrate that 
children cannot easily circumvent age checks. What constitutes a “robust” mechanism, 
and to what standard this is measured against is not entirely clear. Trading Standards 
Institute official advice on online sales of age-restricted products makes a similar point: 
“There is no definitive answer as to what constitutes taking all reasonable precautions or 
exercising all due diligence.” 


16. ISBA and our members have long sought improved enforcement of age limits through 
improved age verification techniques. Further innovation is needed in this area to 
improve standards and there are a range of age verification techniques that could be 
deployed, up to and including formal identification through documentation. We would 
welcome working with the ICO on this issue, a fundamental prerequisite to the draft 
Code. 


Interaction with CAP 


17. In terms of content regulation, we would welcome clarity from the ICO on how its 
proposals relate to online content that is already regulated under the law, the CAP Code 
and by the CMA. The transparency of online content often involves situations in which 
personal data are not processed, and such situations are already regulated by the 
UCPD, the AVMSD and the CAP Code. 


18. The CAP Code, as a matter of principle, ensures that care is taken when featuring or 
addressing children in marketing communications. It also fully recognises that the way 
that children perceive and react to marketing is influence by their age, experience and 
context of the message. Advertising age-restricted products on children’s websites fall 
foul of the CAP Code and the ASA has remit to intervene. 


19. Importantly, in April 2017, CAP reviewed the evidence on children’s critical 
understanding capabilities at different ages. This indicated that children had three distinct 
stages of cognitive development: 0-7; 8-11; 12-15. The guidance was subsequently 
developed to address issues arising with the first two age groups, i.e. those under 12. 
The ICO’s proposed age brackets do not align with those identified by CAP. They should 
do. 
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20. With such a wide range of concerns, we urge the ICO to extend the consultation period, 
conduct a full impact assessment and feasibility study and ensure they engage 
effectively with all stakeholders to ensure that the draft Code meets its objectives. 


